Traefik SSL certificate expired

traefik ssl certificate expired on a public entrypoint means customers hit stale material on the edge proxy—not merely an expired cert on a pod behind Traefik that never terminated TLS.

Traefik terminates TLS for microservices, Docker Compose stacks, and Kubernetes ingress across teams that may never touch PEM files directly. Expiry incidents surface when routers still route traffic while ACME storage failed silently, static TLS secrets aged out, or GitOps restored an old resolver name.

Because Traefik can mix ACME, Kubernetes secrets, and file providers, the fix path starts with which router owns the hostname and which certificate store backs it. Operators who only restart application pods waste time when the edge still serves yesterday's serial.

For ACME-specific resolver and acme.json failure modes, read Traefik ACME certificate expired alongside this listener-focused runbook.

What to check

Map the hostname to a Traefik router, entrypoint, and TLS option. Determine whether tls.certresolver, tls.store, or secretName from Kubernetes supplies the certificate. Confirm whether TLS terminates at Traefik or an upstream cloud load balancer.

Capture live notAfter and serial from the public entrypoint. Compare with Traefik dashboard certificate lists and with files in acme storage or mounted PEM directories. Ephemeral pods without persistent volumes lose ACME state after restart even when routers look healthy.

Review Traefik logs for unable to obtain certificate messages near the prior renewal window. Multi-replica deployments need a single-writer strategy for acme.json or provider-supported shared storage.

Identify mixed deployments where some routers use manual secrets and others use ACME on the same entrypoint—split-brain serials confuse triage.

Step-by-step

Live confirm

HOST=app.example.com
echo | openssl s_client -connect "${HOST}:443" -servername "${HOST}" 2>/dev/null \
  | openssl x509 -noout -dates -serial -issuer

Traefik logs and config

docker logs traefik 2>&1 | tail -n 100
# Kubernetes example:
kubectl logs deploy/traefik -n ingress --tail=100
kubectl get ingressroute,ingress -A | grep -i example

Validate static provider fragments that declare certificateResolvers and entryPoints publishing ports 80 and 443 for challenges.

Fix storage or secrets

Mount persistent volume for acme storage in production. Renew or replace Kubernetes TLS secrets referenced by routers. Fix DNS provider credentials when using DNS-01.

After successful obtain or secret update, roll Traefik:

kubectl rollout restart deploy/traefik -n ingress
# or docker compose restart traefik

External verify

curl -vI --connect-timeout 10 "https://${HOST}/" 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

Repeat per entrypoint if you expose admin and public routers separately.

How to read the output

Openssl notAfter on the customer hostname is the acceptance test. Dashboard certificate views may lag dynamic configuration reloads; trust the handshake.

Issuer name distinguishes Let's Encrypt ACME material from imported corporate chains. Serial change after fix proves new material reached the entrypoint.

Router labels in Kubernetes or Docker provider output show which rule matched your servername. Wrong router means DNS or rule priority issues masquerading as expiry confusion.

Log lines referencing rate limits or challenge failures point to Traefik ACME certificate expired remediation rather than simple clock drift.

Common mistakes

Restarting backend Deployments while Traefik still serves the expired edge cert. Losing acme.json on node drain without backups. Two replicas writing the same acme file without locking.

Terminating TLS at a cloud load balancer while HTTP-01 challenges never reach Traefik. GitOps commits that reintroduce abandoned resolver names still referenced by routers.

Monitoring only in-cluster health probes that hit HTTP backends, not public HTTPS entrypoints customers use.

Applying renewed secrets to the wrong namespace while IngressRoute in production still references the old secret object.

Nomad and Docker Swarm scheduling can place Traefik tasks on nodes without the volume claim that holds acme.json, producing intermittent expiry depending on which task answers health checks. Pin storage claims or replicate certificate material deliberately.

Service meshes that mTLS internal traffic sometimes distract incident bridges while public IngressRoute certificates expire independently. Keep a labeled list of hostnames that terminate at Traefik versus sidecar proxies.

Penetration testers reporting expired certificates on admin entrypoints still breach customer trust when those URLs appear in runbooks or status pages. Treat admin and public expiry with the same urgency when the hostname is customer visible.

Compliance frameworks asking for annual proof of TLS control benefit from archived openssl captures tied to router names. Generic screenshots of pod health do not satisfy auditors focused on customer channels.

Game-day exercises should include one Traefik entrypoint in the scenario matrix even when applications use mesh encryption internally. Executives still open the marketing site in a browser during crises.

When traefik ssl certificate expired aligns with a major DNS migration, verify challenges reached Traefik after TTL cuts. Incidents cluster when old A records still point at decommissioned nodes that served expired defaults.

Platform newsletters can publish a quarterly reminder that Traefik green in Kubernetes does not imply edge TLS green. Cultural repetition reduces recurrence more than additional dashboard tiles alone.

When to use automation

Edge TLS is product TLS for microservice architectures. Automate live checks on every customer-facing hostname Traefik fronts, not only pod readiness endpoints behind the proxy.

SSLdays measures the certificate strangers negotiate on Traefik entrypoints and alerts at 30, 14, 7, and 1 days. Combine with RDAP domain expiration when registration dates threaten the next ACME order. Email is included on all plans; Slack and Discord webhooks ship on paid tiers with hourly polling for larger inventories.

Validate fixes with a live check, then add hostnames to /register so the next resolver error pages platform on-call before marketing hears from customers.